Internal Controls Checklist updated 6-2019.doc · 13. Does integrity of financial and operational results take priority over reporting acceptable performance targets? 14. Are the

Office of the Vice President and Chief Financial Officer Finance and Accounting Division University Controller’s Office

July 2019

TABLE OF CONTENTS

INTRODUCTION ........................................................................................ 2

CONTROL ENVIRONMENT ........................................................................ 3

BASIC ACCOUNTING PROCESSES .............................................................. 6

COLLECTIONS, DEPOSITS AND CASH FUNDS ............................................ 8

PURCHASING AND DISBURSEMENTS ..................................................... 13

ASSET MANAGEMENT ............................................................................ 16

PAYROLL ................................................................................................. 19

HUMAN RESOURCE MANAGEMENT ...................................................... 20

RESEARCH MANAGEMENT AND SUPPORT ............................................. 22

INFORMATION TECHNOLOGY ................................................................ 25

QUESTIONS AND ANSWERS ................................................................... 27

UNIVERSITY OF FLORIDA INTERNAL CONTROL PRINCIPLES ................... 30

GUIDING PRINCIPLES OF FINANCIAL MANAGEMENT ............................ 32

University of Florida 2

INTRODUCTION

The objective of the Internal Control Checklist is to provide the campus community with a tool for evaluating the internal control structure in a department or functional unit, while also promoting effective and efficient business practices. Utilization of this checklist should strengthen internal controls and improve compliance. The checklist is not meant to be absolute but informative when reviewing controls in a given area.

HOW DO I USE THE CHECKLIST?

The checklist should be reviewed annually by individuals accountable for the particular business process. Most internal control procedures are based on common sense. For example, the person having custody of the asset, such as cash, should not be the only person responsible for accounting for it and no one person should be able to complete a requisition/payment transaction or personnel/payroll transaction from beginning to end without appropriate monitoring or oversight. Incompatible duties should be segregated for a check and balance; laws and University policies and directives are expected to be followed. Despite the fact that many internal controls are a simple matter of common sense, taking the time to periodically use this checklist to review the control processes can be a valuable tool in the process and help document your due diligence. This checklist is similar to what auditors might use when performing a review of your department’s internal controls. While “no” responses would normally indicate a potential weakness, this could be off‐set by “compensating” controls within the unit. In this case, it is important to ensure the compensating control is properly documented. It is difficult to make a statement regarding a particular control based on the response to just one question. However, a “no” response will probably be an indicator that compensating controls or additional steps are needed for a particular process. The complete set of checklists is available electronically at http://www.fa.ufl.edu/controller/internal‐control/checklist/. Additional information about internal controls is available at http://www.oia.ufl.edu/Internal_Control/Int_Control.html. For more information about internal controls, a Q&A is provided at the end of this checklist. If you have questions about this checklist, please contact the University Controller’s Office at (352) 392‐1321.

Remember, we all play a part in the university’s internal control system!

3

CONTROL ENVIRONMENT

Department

Preparer(s) Date

YES NO *NS *N/A CHECKLIST QUESTION

□ □ □ □ 1. Are appropriate faculty and staff members familiar with the following? - Board of Trustees Policies

(http://www.trustees.ufl.edu/policies/) - Signature authority delegation chart with the General Counsel - Other relevant operating and compliance requirements and

guidelines specific to your unit or process?

□ □ □ □ 2. Are appropriate faculty and staff familiar with Finance & Accounting Directives and Procedures? (www.fa.ufl.edu)

□ □ □ □ 3. Are appropriate faculty and staff familiar with internal control principles?

□ □ □ □ 4. Are internal controls evaluated when change in leadership, business processes, or technology takes place?

□ □ □ □ 5. Does management demonstrate the importance of integrity and ethical values, including the statement of core values, to faculty and staff? Are they familiar with the Code of Ethics for Public Officers and Employees, Chapter 112 Part III, Florida Statutes?

□ □ □ □ 6. Is staff informed about the options for reporting suspected fraud?

□ □ □ □ 7. Is good communication, collaboration, and team effort emphasized?

□ □ □ □ 8. Is management open to employee suggestions to improve

productivity, service, and quality?

□ □ □ □ 9. Do management and employees have the knowledge, training, and

skills necessary to perform their jobs adequately and continue to take advantage of on‐going training opportunities?

* NS – Not Sure * N/A – Not Applicable

4

CONTROL ENVIRONMENT


□ □ □ □ 10. Has management established a mission statement, set goals, and developed plans to meet its objectives?

□ □ □ □ 11. Are plans and performance targets developed and regularly reviewed?

□ □ □ □ 12. Are the unit’s performance targets realistic and attainable?

□ □ □ □ 13. Does integrity of financial and operational results take priority over reporting acceptable performance targets?

□ □ □ □ 14. Are the unit’s organizational structure and lines/limits of authority

clearly defined and understood by employees?

□ □ □ □ 15. Are employee job descriptions current?

□ □ □ □ 16. Are employee desk procedures and other internal operating procedures current and in a written format? (Key internal controls should be identified).

□ □ □ □ 17. Has the unit maintained an acceptable employee turnover rate?

□ □ □ □ 18. Does employee morale appear to be at an acceptable level?

□ □ □ □ 19. Does the unit have the time, tools, and resources to effectively

accomplish its mission and objectives?

□ □ □ □ 20. Has the unit established any benchmarks with peers to measure its resource use and outcomes?

□ □ □ □ 21. Are all records maintained in accordance with guidelines issued by the Office of the Provost? http://www.aa.ufl.edu/Data/Sites/18/media/policies/records‐management‐information.pdf


5

CONTROL ENVIRONMENT


□ □ □ □ 22. Does the unit have a documented business continuation plan that addresses the absence of key employees and backup procedures for key business processes?

□ □ □ □

23. Are documented risk assessments periodically performed?

□ □ □ □

24. Have designated responsibilities been documented in writing and are they periodically reviewed?

Comments/Compensating Controls:

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

6

BASIC ACCOUNTING PROCESSES

Department

Preparer(s) Date

TRAINING


□ □ □ □ 1. Is fiscal staff familiar with appropriate sections of Finance and Accounting Directives and Procedures? http://www.fa.ufl.edu/directives‐and‐procedures/

□ □ □ □ 2. Has fiscal staff been appropriately trained in the use of the accounting system, including the chart of accounts?

□ □ □ □ 3. Has fiscal staff been appropriately trained in the use of the Enterprise Reporting and the Monthly Financial Reports?

□ □ □ □ 4. Does fiscal staff possess accounting skills and knowledge necessary to adequately perform their responsibilities?


RECONCILIATIONS YES NO *NS *N/A CHECKLIST QUESTION

□ □ □ □ 5. Are Monthly Financial Reports (departmental ledgers) reviewed and reconciled at least monthly?

□ □ □ □ 6. Is the staff performing the reconciliation separate from the staff initiating and finalizing transactions?

□ □ □ □ 7. Are reconciling differences, negative balances, and/or unsupported transactions investigated and corrected timely?

□ □ □ □ 8. Does higher level management review the reconciliation in a timely manner and appropriately document its review?


7

BASIC ACCOUNTING PROCESSES

FUNDS MANAGEMENT YES NO *NS *N/A CHECKLIST QUESTION

□ □ □ □ 9. Are funds for large purchases, travel, etc. encumbered and set aside ahead of time to ensure that funds will be available when payment is due?

□ □ □ □ 10. Are the Monthly Financial Reports for each fund generated and reviewed by appropriate management to compare budgeted balances with actual financial activity?

□ □ □ □ 11. If cost center deficits are anticipated, are appropriate levels of management notified timely and appropriate corrective action taken?

□ □ □ □ 12. Does fiscal staff understand the rules associated with different fund types and are these rules followed when processing financial transaction (E&G Appropriations, Grants, Agency, Auxiliary, Direct Support Organizations, etc.)?

□ □ □ □ 13. Is fiscal staff familiar with the Color of Money at UF? Have appropriate personnel taken the training class?

□ □ □ □ 14. Are any sub‐systems used by the department reconciled to PeopleSoft on a monthly basis?

□ □ □ □ 15. Are the sub‐system reconciliations reviewed by management on a monthly basis?

□ □ □ □ 16. Does fiscal staff and management understand and review any differences between the sub‐system and PeopleSoft?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

8

COLLECTIONS, DEPOSITS AND CASH FUNDS Department

Nature of Cash Funds/Collections

Preparer(s) Date


□ □ □ □ 1. Are staff members responsible for Cash Funds, cash handling, and deposits familiar with relevant Finance and Accounting Directives and Procedures?

□ □ □ □ 2. Are the collection and deposit preparation functions segregated from the accounting functions, including general ledger and accounts receivable maintenance?

□ □ □ □ 3. Has each type of Cash Fund (Change Fund and Petty Cash Fund) been approved by the appropriate party, i.e. department dean/director, and Finance and Accounting ‐ Treasury Management?

□ □ □ □ 4. Are receipts issued or mail logs completed immediately for collections received in person or through the mail?

□ □ □ □ 5. Is the person completing the mail log separate from the person recording the deposit or billing the customer?

□ □ □ □ 6. Are cash register receipts or uniform cash receipts issued and given to the customer each time a cash collection (including collection by check or credit card) is received?

□ □ □ □ 7. Are pre‐numbered receipts, mail logs, and cash register readings independently controlled, accounted for, and compared to validated deposit documentation by an individual with no cash handling responsibilities?

□ □ □ □ 8. Is all supporting documentation for the daily deposits retained centrally with fiscal personnel?

□ □ □ □ 9. Are all copies of voided receipt forms and cash register voids retained, accounted for, and approval documented?


9

COLLECTIONS, DEPOSITS AND CASH FUNDS


□ □ □ □ 10. Are all collections required to be made payable to the proper payee, “University of Florida,” or department/center under the direct control of University of Florida, or the appropriate direct support organization party to the transaction?

□ □ □ □ 11. Are checks required to be restrictively endorsed upon receipt?

□ □ □ □ 12. Are responsibilities for monies fixed at all times? (This would include prohibiting cash handlers from working out of the same cash drawer, requiring documentation of transfers of collections among employees, limiting access to monies, etc.)

□ □ □ □ 13. Are cash drawers or cash boxes secured when the cash custodian leaves his/her workstation?

□ □ □ □ 14. Are appropriate controls in place regarding cashier transitions (breaks, shift change, etc.)?

□ □ □ □ 15. Do cash registers have sufficient built‐in control features to prevent the operator from backing out transactions without supervisory approval or resetting the cash register readings?

□ □ □ □ 16. Are overages and shortages properly documented and appropriately explained?

□ □ □ □ 17. Are cash and checks deposited in a timely manner in accordance with UF Directives and Procedures?

□ □ □ □ 18. Are receipts and deposits reconciled at least monthly with the monthly financial reports?

□ □ □ □ 19. Are Cash Funds and collections physically stored in a safe or equally secure place? Is there a camera, two‐person access restrictions or other safeguards in place?

□ □ □ □ 20. Is knowledge of safe combinations or access to keys restricted to employees with a need‐to‐know or need‐to‐access? Is the combination/keys to the safe changed when there are personnel changes involving staff with this access?


10



□ □ □ □ 21. Are unannounced Cash Fund counts and reviews performed and documented by someone other than the cash fund custodian on a periodic basis?

□ □ □ □ 22. Are duties related to accounts receivable delegated so that no one individual can collect funds, update receivable records and reconcile accounts receivable details?

□ □ □ □ 23. Are Cash Fund variances investigated by management immediately? Does management notify Treasury Management of any unresolved Cash Fund variances?

□ □ □ □ 24. Are deposits transported in person in locked bank bags or sealed tamper‐proof bags?

□ □ □ □ 25. Is the use of Cash Funds restricted from making personal loans, cashing personal checks, reimbursements for purchases made on personal credit cards or debit cards, travel expenses, or taxes for which the university is not liable?

□ □ □ □ 26. Are duties related to accounts receivable delegated so that no one individual can collect funds, update receivable records and reconcile accounts receivable details?

□ □ □ □ 27. Are accounts receivable billings issued at least monthly, or as required by an agreement?

□ □ □ □ 28. Are accounts receivable aged regularly with older accounts receiving appropriate follow‐up?

□ □ □ □ 29. Is the write‐off of delinquent accounts in compliance with university policy?

□ □ □ □ 30. Are cases of suspected fraud or theft brought to the attention of the University of Florida Police Department, the Office of Internal Audit and the University Controller’s Office immediately upon discovery?


11



□ □ □ □ 31. Does unit management periodically review data showing trends regarding the status of receivable balances and take appropriate action if needed?

□ □ □ □ 32. Are sales taxes collected and properly remitted when appropriate? If the services are performed in a county other than Alachua, Payroll & Tax Services must be notified.

□ □ □ □ 33. Have all external revenues, which are possibly subject to Unrelated Business Income Taxes or sales tax, been reviewed by Payroll & Tax Services?

□ □ □ □ 34. Are revenue transactions between departments or component units documented with signed MOUs or contracts/agreements?

□ □ □ □ 35. If the department accepts payment cards for payment, is the department following Finance and Accounting Directives and Procedures on payment cards?

□ □ □ □ 36. If a refund is processed, is it processed back to the original form of payment per UF guidelines?

□ □ □ □ 37. If a payment card refund is processed, is the Payment Card Refund Form completed and sent to Treasury Management?

□ □ □ □ 38. Are Cash Funds kept physically separate from other Funds? Cash

Funds must not be commingled with any other Funds.

□ □ □ □ 39. Are Cash Funds reconciled by someone independent of custodian at

least once per month? If custodian completes the Cash Fund reconciliation, are compensating controls, such as a higher level review of the reconciliation, in place?

□ □ □ □ 40. Are Cash Fund reconciliations reviewed by higher level management?


12



□ □ □ □ 41. Is the Cash Fund Activity Log or alternative form used to document purchases made from Cash Funds? Note: Alternative forms must include information per the UF cash management policy.

□ □ □ □ 42. Are changes to Cash Funds information communicated to Treasury Management including changes in purpose, physical location, custodian, ChartField, and individual(s) with access to the Fund, increasing, decreasing or closing of Cash Fund?

□ □ □ □ 43. Are purchases from Cash Funds for allowable purchases evidenced by itemized receipts?

□ □ □ □ 44. Does the person responsible for custody of Cash Funds understand what to do in case of loss or theft?

□ □ □ □ 45. Are annual Cash Fund confirmations completed and returned to Treasury Management?

□ □ □ □ 46. If the department issues human subject payments, is HSP policy followed for all payments?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

13

PURCHASING AND DISBURSEMENTS

Department

Preparer(s) Date


□ □ □ □ 1. Are staff responsible for requisition/purchasing, vendor payments, and travel familiar with the applicable directives?

□ □ □ □ 2. Are the duties for initiating requisitions, receiving purchased items, processing of invoices for payment, and reconciliation of the departmental ledger separated between two or more employees?

□ □ □ □ 3. Are contracts approved by all appropriate parties prior to the effective date of the contract?

□ □ □ □ 4. Are transactions between departments or component units documented with signed MOUs or contracts/agreements?

□ □ □ □ 5. Does supervisory staff review charges recorded on the departmental ledger and inquire about unfamiliar charges?

□ □ □ □ 6. Is management’s review of the departmental ledger, reconciliation, and supporting documentation appropriately documented?

□ □ □ □ 7. Do unit procedures ensure the best combination of quality, total price, and delivery are evaluated when acquiring goods or services?

□ □ □ □ 8. Are purchase requisitions initiated and approved by employees specifically authorized to perform this task?

□ □ □ □ 9. Are purchases appropriately supported by a purchase order and submitted in a timely manner?

□ □ □ □ 10. Are all vendor invoices processed timely?

□ □ □ □ 11. Are all invoices independently reviewed for completeness, accuracy, compliance with university directives, and agreement to supporting documentation before approval for payment?

□ □ □ □ 12. Do vouchers receive appropriate supervisory approval before payment?


14



□ □ □ □ 13. Are appropriate discounts offered being taken?

□ □ □ □ 14. If the invoice inappropriately included taxes, were they deducted prior to payment?

□ □ □ □

15. Are returned purchases controlled in such a manner to ensure that the department receives the credit or refund due the department?

□ □ □ □ 16. Are vendor invoices and travel reimbursements controlled in such a manner as to prevent duplicate payment?

□ □ □ □ 17. Are encumbrances and disbursements reconciled with the departmental ledger?

□ □ □ □ 18. Does the Dean, Director, or Department Head approve (by signature) the issuance of purchasing cards?

□ □ □ □ 19. Does the department obtain supporting receipts and cardholder’s signature and/or generate “PCard Paid Charges Aging Report” reports for each cardholder to sign?

□ □ □ □ 20. Are purchasing card transactions reconciled and approved timely per the PCard directives? http://www.purchasing.ufl.edu/departments/pcard/default.asp

□ □ □ □ 21. Does department management periodically review a list of departmental cardholders and their limits to determine if changes need to be made?

□ □ □ □ 22. Are originators trained to ensure proper posting of travel data?

□ □ □ □ 23. Does the department create an “Authorized Approver Request Form” to authorize a designee to approve travel?

□ □ □ □

24. Does the approver verify that a travel authorization was created before the travel occurred?

□ □ □ □

25. Do travelers (except undergraduates on study abroad/independent study programs) participating in official university international travel register online at the UF International Center Web site (http://www.ufic.ufl.edu/travelregistration.html) before travel?


15



□ □ □ □ 26. Are travel authorizations compared to the traveler’s budget balance to ensure that the traveler is still within the limits of his/her budget?

□ □ □ □ 27. Are travel advances made and approved through the Travel and Expense Module?

□ □ □ □ 28. Are travel advances settled timely?

□ □ □ □

29. Is a periodic review made of telephone lines and equipment to ensure that such telephone lines and equipment is needed?

□ □ □ □

30. Is the use of UF property limited to official business use only?

□ □ □ □

31. Are maintenance agreements reviewed periodically, especially before they are renewed, to ensure that the equipment the maintenance agreement is intended to cover is still owned and used by the unit and that it is still in the unit’s best interest to continue to carry the maintenance coverage?

□ □ □ □

32. Are the purchase, storage, and issuance of supplies properly controlled to prevent over‐purchasing, pilferage, deterioration, and damage?

□ □ □ □

33. Does the department maintain appropriate documentation, such as the Cell Phone Reimbursement Form, explaining the business purpose for cell phone reimbursement and how the reimbursement was calculated?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

16

ASSET MANAGEMENT

Department

Preparer(s) Date


□ □ □ □ 1. Are department property custodians familiar with the appropriate section of Finance and Accounting Directives and Procedures for the management of capital assets and attractive property?

□ □ □ □ 2. Is the department restricting access to areas with capital assets and attractive property? Restricting access includes work areas, storerooms, and buildings to only appropriate individuals.

□ □ □ □ 3. Are Campus Police and Asset Management notified immediately of any stolen or missing property?

□ □ □ □ 4. Is the annual inventory completed timely for all capital assets? The deadline for all STAR and IFAS departments is January 31st and for main campus and health science center is March 31st?

□ □ □ □ 5. If a STAR, is there anything they need to do?

□ □ □ □ 6. Are all off‐site certifications for capital assets and attractive property completed timely by September 30th?

□ □ □ □ 7. Is all mandatory attractive property such as mobile computing devices (laptops, tablets, and Ipads), items located off‐site, munitions, items purchased with equipment use fees (fund 163), and vehicles (including vessels and aircraft that are titled, licensed or registered with the DMV), added to myAssets as attractive property and decaled within 30 days of acquisition?

□ □ □ □ 8. Are all attractive property being tracked and inventoried annually by the departments using myAssets?

□ □ □ □ 9. Are approved foreign travel requests received from Asset Management prior to equipment being shipped outside the United States or accompanying a traveler outside the United states?

□ □ □ □ 10. Does your department have a written attractive property policy?


17

ASSET MANAGEMENT


□ □ □ □ 11. Is property which is furnished or donated to UF (by the government or faculty transferring to UF from another institution) added to myAssets and decaled within 30 days of UF receiving the property?

□ □ □ □ 12. Is Asset Management notified of all additions and completions of property constructed at the University (work‐in‐process) within 30 days of invoice payment, so the capital asset record can be updated?

□ □ □ □ 13. Is a “Property Update” completed within 30 days of purchase to update the capital asset or attractive property record in myAssets for serial number, manufacture, UFID, etc.?

□ □ □ □ 14. When moving capital assets or attractive property from one location to another within your department, is Asset Management notified by a “Property Update”, informing Asset Management of the new location information in myAssets within 30 days?

□ □ □ □ 15. When transferring property/equipment to a different department or project, is an online “Report of Transfer Request” form completed and approved within 30 days in myAssets in a timely manner?

□ □ □ □ 16. Are surplus requests completed in myAssets within 30 days for capital assets and attractive property which is obsolete, broken, or property that is no longer needed by the department?

□ □ □ □ 17. Is surplus property secured until being removed by UF Surplus after an approved surplus pick‐up request?

□ □ □ □ 18. Is Asset Management notified of any errors or discrepancies on the equipment inventory report in a timely manner?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

18

PAYROLL

Department

Preparer(s) Date


□ □ □ □ 1. Are staff members with responsibility for payroll familiar with the Finance and Accounting Directives and Procedures relating to Payroll? http://www.fa.ufl.edu/directives‐and‐procedures/payroll/

□ □ □ □ 2. Have employees charged with payroll and Commitment Accounting responsibilities been appropriately trained?

□ □ □ □ 3. Are time and labor entries approved by the dean, director, unit head, or other supervisor who has supervisory responsibilities over the persons whose time and/or payment is being approved?

□ □ □ □ 4. Does the payroll processor review the Preliminary Pay Lists, including the Employees Missing a Paycheck section, to ensure that employees will be paid correctly?

□ □ □ □ 5. Is the Final Pay List retained in the department in hard copy or electronic format, with evidence of approval including signature and date, to document that faculty, staff and other employees are paid according to wage contracts and terminated employees are not paid?

□ □ □ □ 6. Is the Final Pay List reviewed in a timely manner so Payroll & Tax Services can be notified by the appropriate deadlines of any advices requiring EFT cancellation and/or any emergency check requests?

□ □ □ □ 7. Are Commitment Accounting entries properly approved, made timely, and accurately?

□ □ □ □ 8. For non‐exempt employees required to maintain timesheets for time worked, do the time records reflect the actual hours/minutes worked rather than the hours scheduled to be work?

□ □ □ □ 9. If payroll checks and earning statements are in the possession of the department, are they properly secured prior to delivery?


19

PAYROLL


□ □ □ □ 10. Have procedures been implemented to ensure that leave is properly approved and accurately recorded in myUFL?

□ □ □ □

11. Are appropriate identification and authorization required if paychecks or earning statements are to be provided to individuals other than the employee?

□ □ □ □ 12. Additionally, if the employee is unknown to the paycheck distributor, is appropriate identification required before the pay check is released?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

20

HUMAN RESOURCE MANAGEMENT Department

Preparer(s) Date


□ □ □ □ 1. Are employees with HR administrative responsibilities familiar with human resource policies? http://www.hr.ufl.edu/policies/ http://www.hr.ufl.edu/forms/

□ □ □ □ 2. Are hiring practices reflective of the university's non‐discrimination policy?

□ □ □ □ 3. Are references and past work experience of new employees, including faculty, verified and documented?

□ □ □ □ 4. Is the ePAF completed by the fourth day of work?

□ □ □ □ 5. Is the visa status of foreign national employees validated on a quarterly basis?

□ □ □ □ 6. Do new employees participate in new employee orientation and are they provided with the employee handbook? http://www.hr.ufl.edu/policies/handbook.pdf

□ □ □ □ 7. Do new employees complete prevention of sexual harassment training within 30 days of date of hire?

□ □ □ □ 8. Are duties relating to approval of new hires and approval of time/labor or review of payroll segregated?

□ □ □ □

9. Are confidential records maintained in accordance with retention schedules and access limited to those with a “need to know”?

□ □ □ □ 10. Are performance evaluations completed annually for employees when required by HR?

□ □ □ □ 11. Are employees who are covered by the Fair Labor Standards Act (non‐exempt/hourly employees) compensated for overtime worked?


21

HUMAN RESOURCE MANAGEMENT


□ □ □ □ 12. Are unit procedures in place to ensure that undergraduate student employees do not work more than 20 hours a week (unless granted a waiver from Student Employment) and do not work during scheduled classes without documentation that the class has been canceled?

□ □ □ □ 13. Are procedures in place to ensure awareness and compliance with the university’s policy for reporting outside employment activities, and any potential conflicts of interest and nepotism?

□ □ □ □

14. Are terminations of appointments for employees separating from the university processed timely and the exit checklist reviewed? http://www.hr.ufl.edu/emp_relations/forms/exit_checklist.pdf

□ □ □ □ 15. Have employees with HR administrative responsibilities attended training programs that are specific to their roles in the organization? http://www.hr.ufl.edu/training/default.asp



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

22

RESEARCH MANAGEMENT AND SUPPORT

Department

Preparer(s) Date


□ □ □ □ 1. Are staff members responsible for contracts and grants familiar with the directives and procedures relating to contracts and grants? http://www.fa.ufl.edu/directives‐and‐procedures/ , http://cfo.ufl.edu/administrative‐units/gbas/gbas‐resource‐center/contracts‐and‐grants/)

□ □ □ □ 2. Is staff familiar with the Office of Research policies, procedures and best practices? (http://research.ufl.edu/cg/resources.html)

□ □ □ □ 3. Have staff and faculty been provided sufficient training to understand the special requirements of expending contract and grant funds, effort reporting, and in general ensuring compliance with grant or contract terms and Federal regulations? See training resources at: http://hr.ufl.edu/learnandgrow/courses‐registration/sponsored‐research‐training/http://hr.ufl.edu/training/catalog/compliance.asp

□ □ □ □ 4. Are appropriate procedures in place to ensure that all technical and progress reports are prepared by employees directly involved with the grant program or contract and are submitted to the sponsor or contractor in accordance with the terms of the agreement?

□ □ □ □ 5. Are there policies and procedures to address circumstances when an award has not yet been accepted by the university (ex: set up of temporary accounts), excess funds remain after completion of a project, and charges are in excess of allowed amounts?

□ □ □ □ 6. Are costs directly charged to a grant or used as cost sharing reviewed to assure they are reasonable, allocable, consistently treated, and meet any restrictions that apply?

□ □ □ □

7. Does your unit review terms and conditions of contractual agreements regarding limitations for expenditures before purchases are charged to a contract or grant?


23



□ □ □ □ 8. Are unit procedures in place to ensure travel is an allowable expense under sponsor terms, charged at allowable rates, and benefits the grant charged?

□ □ □ □ 9. Are salaries of administrative, clerical staff, and non‐salary administrative items charged directly to a grant or sponsored project only if such services directly benefit the project, and for federal programs, only if they are explicitly budgeted for and CAS exemption received?

□ □ □ □ 10. Is biweekly payroll distribution managed to assure that employee payroll is charged to sponsored projects consistent with employee’s activities rather than availability of funds?

□ □ □ □ 11. Are payroll charges appropriately distributed and reported for employees whose compensation exceeds a sponsor’s salary cap or other budgetary restrictions?

□ □ □ □ 12. Are policies and procedures in place to ensure payroll or other expenditure transfers are appropriate, approved, and processed timely and include appropriate justification and supporting documentation?

□ □ □ □ 13. Are reimbursements to sub grantees/subcontractors reviewed by Principal Investigators (PI) who ensures the appropriateness of charges?

□ □ □ □ 14. Are purchases of fixed assets made at such a time within the life of the project to allow for proper utilization of that asset in accomplishment of the project objectives?

□ □ □ □ 15. Are procedures in place to ensure expenditures are not charged after the grant period, and assist core Contract and Grant offices with the timely closeouts of awards?

□ □ □ □ 16. Where projects require cost sharing or matching, does the unit compare regularly accumulated cost shared amounts with cost sharing requirements to ensure that the requirements will be met?


24



□ □ □ □ 17. Are procedures in place to ensure expenditures are not charged after the grant period, and assist core Contract and Grant offices with the timely closeouts of awards?

□ □ □ □ 18. Where projects require cost sharing or matching, does the unit compare regularly accumulated cost shared amounts with cost sharing requirements to ensure that the requirements will be met?

□ □ □ □ 19. Is there a control in place to ensure that expenses reported for purposes of cost sharing are not already charged directly to other sponsored projects unless specifically granted permission by both sponsors?

□ □ □ □

20. Are grant summary reports reviewed and reconciled to supporting documentation periodically to verify that balances agree to amounts reported in myUFL?

□ □ □ □ 21. Are staff members aware of Export Controls rules and regulations?

□ □ □ □ 22. Are staff members aware of human subject, international, animal, conflict and other non‐fiscal compliance requirements?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

25

INFORMATION TECHNOLOGY

Department

Preparer(s) Date

Note: There are a large number of safeguards that should be implemented by Information Technology professionals, or anyone that manages information technology resources for the unit. Those controls are assessed as part of the university’s Integrated Risk Management process. The administrative controls below are intended to ensure a unit is properly engaged with the Information Security Office and the UF Privacy Office.

INFORMATION SECURITY YES NO *NS *N/A CHECKLIST QUESTION

□ □ □ □ 1. Are appropriate faculty and staff members familiar with University of Florida information technology policies and standards, including those for information security? Policies are available at: http://www.it.ufl.edu/policies

□ □ □ □ 2. Does the unit complete an Information Security risk assessment for each information system (including ‘cloud’ services); prior to purchase of new technology products, systems or services; every two years; or when systems are upgraded? More information is at https://security.ufl.edu/it‐workers/risk‐assessment/

□ □ □ □ 3. Has an Information Security Administrator been designated, and is this person’s role communicated to others in the department?

□ □ □ □ 4. Has an Information Security Manager been designated, and is this person’s role communicated to others in the department?

□ □ □ □ 5. Has a Departmental Security Administrator been designated, and is this person’s role communicated to others in the department?

□ □ □ □ 6. Does the unit have a process to immediately notify the DSA and IT staff of personnel changes, including terminations and reassignments, in order to change roles and/or account permissions?

□ □ □ □ 7. Does the DSA review all roles annually before certifying?

□ □ □ □ 8. Has the unit classified sensitive data (FERPA, HIPAA, etc.) used within the unit, and informed users of each data type of that classification?

□ □ □ □ 9. Has unit staff completed appropriate training for the sensitive data?

□ □ □ □ 10. Are users informed of reporting procedures for computer security incidents?


26

INFORMATION TECHNOLOGY


□ □ □ □ 11. Are employees trained on information security?

□ □ □ □ 12. Does the unit have a business continuity plan, providing for operation after a catastrophic loss of facilities, equipment, or Information Technology?

□ □ □ □ 13. Does the business continuity plan address any sub‐systems used by the department?

□ □ □ □ 14. Are all sub‐systems adhering to information technology policies?

□ □ □ □ 15. Are there access controls in place for all sub‐systems used by department?

□ □ □ □ 16. Are all users informed of the university’s privacy policy?

□ □ □ □ 17. Is all Restricted Data properly disposed of, such as by shredding or following the UF Media Sanitization Standard?

□ □ □ □ 18. Are all users informed of procedures for reporting privacy incidents?



…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………………………………………………………………………

27

QUESTIONS AND ANSWERS What is Internal Control? Internal control in its broadest sense is a process, affected by an organization’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

Effectiveness and efficiency of operations

Accuracy and reliability of reporting

Compliance with applicable rules, laws and regulations Internal Control components include Control Environment, Risk Assessment, Control Activities, Information and Communication and Monitoring. Common control activities may include:

Segregation of functional responsibilities to create a system of checks and balances.

A system of authorization and record procedures to provide reasonable accounting control over assets, liabilities, revenues, and expenditures.

Development of policies and procedures for prescribing and documenting the business and control processes. This should be reviewed and adjusted as needed to reflect changes in the business and control environment.

What is legal/managerial compliance? For the purposes of this checklist, legal and managerial compliance refers to compliance with the various laws, rules, policies, directives, and procedures that set the guidelines and parameters for our operations. Legal and managerial compliance requirements include, but are not limited to, the following:

Federal Laws and Regulations, including 2 CFR‐200 Florida Laws, Statutes, and Administrative Code Federal Cost Accounting Standards University of Florida Board of Trustee Policies, Resolutions, and By‐laws University of Florida Finance and Accounting Directives and Procedures University Controller Memoranda Departmental Policies and Procedures Individual areas may impose additional business and/or control practices.

28

How can I operate more efficiently? There is no short answer to this question. Skilled, well‐informed, ethical and motivated faculty and staff is an important ingredient to an effective operation. Staff should be provided adequate training opportunities and understand what is expected of them. Good lines of communications are essential. The fast pace of technological advancements, changes in regulatory compliance requirements and staff turnover, it is essential to regularly review the various processes your unit has in place. These reviews must include understanding why tasks are being performed, determining if tasks add any value to the process, and questioning if there is a better way to accomplish them. Examining past issues is a useful way of preventing them from being repeated in the future. Reviewing the structure or operations of similar organizations may also provide ideas for improvement.

What should we do if there isn’t enough staff to segregate incompatible duties? Some areas, by virtue of their size, are not able to implement basic controls such as segregation of

duties without an unreasonable expenditure of funds. Basically, the cost of the control exceeds the

benefit of segregation of duties. In these cases, it is important that management institute

compensating controls to protect the employees and the university.

Compensating controls are less desirable than basic internal controls, such as segregation of duties,

because they generally occur after the transaction is complete. It takes more resources to investigate,

correct errors, and recover losses than it does to prevent them in the first place.

Examples of compensating controls include:

A manager may perform a high level review of detailed report of transactions completed by an employee that performs incompatible duties.

A manager may periodically select a sample of transactions, request and review the supporting documents to ensure that they are complete, appropriate, and accurately processed. This monitoring procedure should be documented.

Increase supervisory oversight: Other forms of activities a manager may perform as compensating control are observation and inquiry. Where appropriate, increasing supervisory reviews through the observation of processes performed in certain functions and making inquiries of employees.

Have someone from outside the area perform an external review of activities. For instance, if two separate areas don’t have enough employees to separate duties, the two different areas may be able to share responsibilities or “check” each other.

What should we do if we identify potential control deficiencies or we have questions about this checklist? Risks associated with potential control deficiencies may differ from unit to unit. Unit management is the first channel to address the implications of the deficiencies. Other resources include the Controller’s Office (352‐392‐1321) and the Office of Internal Audit ([email protected]).

29

Are there policies or principles established by the University of Florida regarding internal controls and financial management? Yes, the University of Florida Internal Control Principles and Guiding Principles of Financial Management, both of which were adopted by the Board of Trustees, are on the following pages. These may be accessed electronically at http://www.fa.ufl.edu/controller/guiding‐principles/ and http://www.fa.ufl.edu/controller/internal‐control/.

30

UNIVERSITY OF FLORIDA INTERNAL CONTROL PRINCIPLES

(These Internal Control Principles were adopted by the University of Florida, Audit Committee of the Board of Trustees.)

University administrators and managers are charged with the responsibility for establishing a network

of processes with the objective of controlling the operations of the University of Florida in a manner

which provides the board of trustees reasonable assurance that:

Data and information published either internally or externally is accurate, reliable, complete,

and timely.

The actions of administrators, officers, and employees are in compliance with the university’s

policies, standards, plans and procedures, and all relevant laws and regulations.

The university’s resources (including its people, systems, data/information bases, and client

goodwill) are adequately protected.

Resources are acquired economically and employed effectively; quality business processes

and continuous improvement are emphasized.

The university’s internal controls promote the achievement of plans, programs, goals, and

objectives.

Controlling is a function of management and is an integral part of the overall process of managing

operations. As such, it is the responsibility of managers at all levels of the university to:

Identify and evaluate the exposures to loss relating to their particular sphere of operations.

Specify and establish policies, plans, and operating standards, procedures, systems, and other

disciplines to be used to minimize, mitigate, and/or limit the risks associated with the

exposures identified.

Establish practical controlling processes that require and encourage administrators, officers,

and employees to carry out their duties and responsibilities in a manner that achieves the

control objectives outlined above.

Maintain the effectiveness of the controlling processes established and foster continuous

improvement to these processes.

The internal audit activity is charged with the responsibility for ascertaining that the ongoing

processes for controlling operations throughout the organization are adequately designed and are

functioning in an effective manner. The University of Florida Office of Internal Audit (OIA) is

31

responsible for reporting to management and the Committee on Audit and Operations of the Board

of Trustees on the adequacy and effectiveness of the organization’s systems of internal control,

together with ideas, counsel, and recommendations to improve the systems.

The Committee on Audit and Operations is responsible for monitoring, overseeing, and evaluating the

duties and responsibilities of management, the internal audit activity, and the external auditors as

those duties and responsibilities relate to the organization’s processes for controlling its operations.

The Committee is also responsible for determining that all major issues reported by the internal audit

activity, the external auditor, and other outside advisors have been satisfactorily resolved. Finally,

the Committee is responsible for reporting to the full board significant matters pertaining to the

university’s internal control structure.

32

UNIVERSITY OF FLORIDA GUIDING PRINCIPLES OF FINANCIAL MANAGEMENT

(These Guiding Principles were adopted by the University of Florida, Board of Trustees at their September, 2006 meeting.)

Scope: The university is committed to conducting business in a fiscally responsible manner under the highest ethical standards. The university will adopt the following principles: Principles of Financial Management:

Maintain accounting records in accordance with Generally Accepted Accounting Principles (G.A.A.P.) which provide full‐disclosure of compliance with stewardship responsibilities of the university.

Maintain an internal control environment which enhances sound business practices and clearly defines roles, responsibilities and accountability.

Ensure that applicable laws, regulations and donor or sponsor requirements or restrictions are complied with and that documentation standards provide assurances of such compliance.

Provide accurate and relevant managerial financial reports. Standardized and cost center specific reports will be available as management tools for employees with delegated budgetary responsibilities. Higher level reports will be provided to those employees with broader level fiscal responsibilities

Utilize appropriate budgetary controls applicable to fund source (i.e. state appropriations, auxiliary operations, sponsored research projects) to monitor variances and provide explanations of deviations.

Maintain appropriate levels of financial transaction reviews and approvals by university personnel responsible for budgetary entities.

Involve both internal and external parties to provide periodic independent oversight of university financial activities. Such parties shall include accounting professionals within the university, internal and external auditors, and governing bodies as appropriate.

Ensure all employees are aware of their responsibility to report suspected fraudulent or other dishonest acts and deviations from the Principles of Financial Management to their supervisor, appropriate administrator or the university’s Office of Internal Audit.

Documents

Internal Controls Checklist updated 6-2019.doc · 13. Does integrity of financial and operational results take priority over reporting acceptable performance targets? 14. Are the